CVE-2026-7177: 
NextChat vulnerability analysis and mitigation

CVE-2026-7177 is a Server-Side Request Forgery (SSRF) vulnerability in ChatGPTNextWeb NextChat (also known as ChatGPT-Next-Web) affecting versions up to and including 2.16.1. The flaw resides in the proxyHandler function within app/api/[provider]/[...path]/route.ts, where the application blindly trusts the attacker-controlled x-base-url HTTP header to determine the upstream request destination without any domain validation. Disclosed on April 27, 2026, the vulnerability requires no authentication and can be exploited remotely. It carries a CVSS v3.1 base score of 7.3 (High) and a CVSS v4.0 base score of 5.5 (Medium) (Github Advisory, Feedly).

The root cause is classified as CWE-918 (Server-Side Request Forgery). The app/api/[provider]/[...path]/route.ts route proxies frontend requests to LLM provider APIs; when an unrecognized provider name is specified, the route falls back to the generic proxyHandler in app/api/proxy.ts. This handler constructs the fetch URL by directly concatenating the user-supplied x-base-url header with path segments and query parameters: const fetchUrl = \${req.headers.get("x-base-url")}/${subpath}?${req.nextUrl.searchParams.toString()}`;. Because no domain whitelisting or loopback address validation is applied (unlike the patched WebDAV handler), an attacker can supply any internal or external URL — such as http://127.0.0.1` or http://169.254.169.254 — and the server will fetch and stream the response back to the client (GitHub Issue #6742, PoC Gist).

Successful exploitation allows unauthenticated remote attackers to use the NextChat server as an open proxy to reach internal network services that would otherwise be inaccessible from the internet, effectively bypassing firewalls and network segmentation. Attackers can access cloud instance metadata services (e.g., AWS IMDSv1 at http://169.254.169.254) to steal temporary cloud credentials, enumerate and interact with internal APIs, or pivot to other internal systems. The vulnerability also enables the server to be used as an anonymous proxy for attacking external targets, creating attribution and abuse risks (GitHub Issue #6742, Github Advisory).

A public proof-of-concept exploit (Python script) was released alongside the vulnerability disclosure on April 7, 2026, and is available via a public GitHub Gist (PoC Gist). The exploit requires no authentication and has low attack complexity, making it trivially weaponizable. As of the time of reporting, there is no confirmed evidence of active in-the-wild exploitation, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.045% (low probability of exploitation in the next 30 days), though the GitHub Advisory Database reports 0.107% (Github Advisory, Feedly). The project maintainers had not responded to the issue report at the time of disclosure.

1. Reconnaissance: Identify publicly exposed NextChat instances (version ≤ 2.16.1) using search engines like Shodan or Censys, or by scanning for the default port 3000 with the NextChat web interface.
2. Identify the vulnerable endpoint: Target the generic provider fallback route by specifying an unrecognized provider name in the URL path, e.g., http://<target>:3000/api/unknown-provider/<path>?<params>.
3. Craft the SSRF request: Set the x-base-url HTTP header to the desired internal or external target URL (e.g., http://169.254.169.254 for AWS metadata, http://127.0.0.1:<port> for local services, or any internal IP).
4. Send the exploit request: Issue an HTTP GET request to the target endpoint with the malicious header. Example using the public PoC:

import requests
target = "http://<nextchat-host>:3000/api/unknown-provider/latest/meta-data/iam/security-credentials/"
headers = {"x-base-url": "http://169.254.169.254"}
response = requests.get(target, headers=headers, timeout=10)
print(response.text)

5. Retrieve the response: The server fetches the internal resource and streams the response body back to the attacker, potentially exposing cloud credentials, internal service data, or other sensitive information (GitHub Issue #6742, PoC Gist).

• Network: Outbound HTTP requests from the NextChat server to internal IP ranges (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or cloud metadata endpoints (169.254.169.254, fd00:ec2::254); outbound requests to unexpected external domains originating from the NextChat process.
• Logs: Web server/application access logs showing requests to /api/<unknown-provider>/ paths (where the provider name is not a recognized LLM provider such as openai, azure, google, etc.) with an x-base-url header present; HTTP 200 responses to such requests containing content from internal services.
• Process: Unusual outbound network connections initiated by the Node.js process running NextChat to internal network addresses or cloud metadata IPs.
• File System: No direct file system artifacts expected for SSRF exploitation, but evidence of credential theft may appear as unauthorized API calls in cloud provider logs (e.g., AWS CloudTrail showing API calls using credentials retrieved from IMDS) (GitHub Issue #6742, PoC Gist).

Users should update NextChat to a version newer than 2.16.1 once a patched release is available; a patch is referenced via the GitHub Advisory (GHSA-ff75-fg5h-fjx7) (Github Advisory). As an immediate workaround, implement network-level controls to restrict the NextChat server's outbound connectivity to only required LLM API endpoints, blocking access to internal RFC-1918 address ranges and cloud metadata services. Deploy a Web Application Firewall (WAF) rule to detect and block requests containing an x-base-url header pointing to internal or loopback addresses. Monitor outbound network traffic from the application server for anomalous connections to internal resources.

The vulnerability was reported by researcher YLChen-007 via a GitHub issue (#6742) on April 7, 2026, with a detailed advisory and PoC published simultaneously; the project maintainers had not responded at the time of disclosure (GitHub Issue #6742). The advisory was picked up by automated threat intelligence aggregators including RedPacket Security and various CVE tracking platforms shortly after NVD publication on April 27, 2026 (Feedly). No significant vendor statement or notable researcher commentary beyond the original disclosure has been identified.